# US 2018/0323967 A1 · Cryptographically securing entropy for later use > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0323967 A1 - Document ID: US20180323967A1 - Status: Published application - Kind: A1 - Application number: 15/584,569 - Filed: 2017-05-02 - Published: 2018-11-08 - Earliest claimed: 2017-05-02 - Assignees: Seagate Technology LLC - Applicants: Seagate Technology, LLC - Inventors: Timothy J. Courtney - Web page: https://patentgrep.com/patent/US20180323967A1 ## CPC - H04L 9/0656: {Pseudorandom key sequence combined element-for-element with data sequence, e.g. one-time-pad [OTP] or Vernam's cipher} - G06F 7/58: Random or pseudo-random number generators - H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC} - H04L 9/0869: {involving random numbers or seeds} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Apparatus and method for managing entropy in a cryptographic processing system. In some embodiments, a first block of conditioned entropy is generated from at least one entropy source. The first block of conditioned entropy is subjected to a first cryptographic process to generate cryptographically secured entropy which is stored in a memory. The cryptographically secured entropy is subsequently retrieved from the memory and subjected to a second cryptographic process to generate a second block of conditioned entropy, which is thereafter used as an input in a third cryptographic process such as to encrypt or decrypt user data in a data storage device. The first cryptographic process may include an encryption algorithm to generate ciphertext and a hash function to generate a keyed digest value, such as an HMAC value, to detect tampering with the ciphertext by an attacker. The second cryptographic process may decrypt or further encrypt the ciphertext. ## Claims ### Claim 1 A computer implemented method comprising: generating a first block of conditioned entropy from at least one entropy source; subjecting the first block of conditioned entropy to a first cryptographic process to generate cryptographically secured entropy; storing the cryptographically secured entropy in a memory; subsequently retrieving the cryptographically secured entropy from the memory; applying a second cryptographic process to the retrieved cryptographically secured entropy to generate a second block of conditioned entropy; and using the second block of conditioned entropy in a third cryptographic process. ### Claim 2 (depends on 1) The method of claim 1, wherein the first block of conditioned entropy is identical to the second block of conditioned entropy. ### Claim 3 (depends on 1) The method of claim 1, wherein the first block of conditioned entropy has a selected entropy level, and the second block of conditioned entropy is different from the first block of conditioned entropy and has the same selected entropy level as the first block of conditioned entropy. ### Claim 4 (depends on 1) The method of claim 1, wherein the first block of conditioned entropy is generated using an entropy manager circuit comprising an extractor circuit that extracts entropy from an input entropy value from the at least one entropy source, and an entropy qualification circuit that provides the first block of conditioned entropy with at least a predetermined threshold level of entropy. ### Claim 5 (depends on 4) The method of claim 4, wherein the subsequently retrieving, applying and using steps are carried out responsive to the entropy manager circuit being in a non-operational state to generate additional blocks of conditioned entropy. ### Claim 6 (depends on 4) The method of claim 4, wherein the generating, subjecting and storing steps are carried out during a first powered session of a processing device, wherein the method further comprises applying a power cycle operation to the processing device to conclude the first powered session and initiate a subsequent, second powered session, and the subsequently retrieving, applying and using steps are carried out during the second powered session prior to operation of the entropy manager circuit to generate a block of conditioned entropy during the second powered session. ### Claim 7 (depends on 1) The method of claim 1, wherein the first cryptographic process is carried out by an encryption engine circuit that encrypts the first block of conditioned entropy using a selected encryption key to produce ciphertext, and a keyed digest value generator circuit that applies a selected hash function to the ciphertext to generate a keyed digest value. ### Claim 8 (depends on 7) The method of claim 7, wherein the keyed digest value is an HMAC value. ### Claim 9 (depends on 7) The method of claim 7, wherein the keyed digest value is a first keyed digest value, and the second cryptographic process comprises using the ### Claim 10 (depends on 1) The method of claim 1, wherein the first cryptographic process comprises an encryption operation upon the first block of conditioned entropy using a selected encryption key to generate ciphertext, and the second cryptographic process comprises a decryption operation upon the ciphertext using the selected encryption key to return the first block of conditioned entropy. ### Claim 11 (depends on 1) The method of claim 1, wherein the at least one entropy source comprises a random number generator. ### Claim 12 (depends on 1) The method of claim 1, wherein the at least one entropy source provides entropy values having a low entropy component, and the generating step comprises using an extractor circuit to provide entropy values having a high entropy component. ### Claim 13 An apparatus comprising: an entropy source configured to generate a sequence of entropy values; an entropy manager circuit configured to generate a first block of conditioned entropy from the sequence of entropy values, apply a first cryptographic process to the first block of conditioned entropy to generate cryptographically secured entropy, and direct the storage of the cryptographically secured entropy in a non-volatile memory; a control circuit configured to, responsive to a power cycle operation in which the entropy manager circuit was transitioned between an operational state and a deactivated state, retrieve the cryptographically secured entropy from the non-volatile memory, apply a second cryptographic process to the retrieved cryptographically secured entropy to generate a second block of conditioned entropy, and use the second block of conditioned entropy in a third cryptographic process. ### Claim 14 (depends on 13) The apparatus of claim 13, further comprising a main memory, wherein the third cryptographic process applies an encryption or decryption operation upon user data transferred between the main memory and a host device. ### Claim 15 (depends on 13) The apparatus of claim 13, wherein entropy manager circuit comprises an encryption engine circuit that applies the first cryptographic process to encrypt the first block of conditioned entropy using an encryption key to form ciphertext, and a keyed digest generator circuit which applies a selected hash function to the ciphertext to generate an HMAC value associated with the ciphertext. ### Claim 16 (depends on 15) The apparatus of claim 15, wherein the control circuit comprises a keyed digest verification circuit which verifies the HMAC value and a decryption engine circuit that applies the second cryptographic process to decrypt the ciphertext using the encryption key to return the first block of conditioned entropy. ### Claim 17 (depends on 15) The apparatus of claim 15, wherein the control circuit comprises a keyed digest verification circuit which verifies the HMAC value and a second encryption engine circuit that encrypts the ciphertext using a second encryption key to generate the second block of conditioned entropy. ### Claim 18 (depends on 15) The apparatus of claim 15, wherein the entropy source is within a hardware trust boundary of the control circuit. ### Claim 19 (depends on 13) The apparatus of claim 13, wherein the one entropy source provides entropy values having a low entropy component, and the entropy manager circuit comprises an extractor circuit configured to generate the first block of conditioned entropy having a high entropy component from the entropy values from the entropy source. ### Claim 20 (depends on 13) The apparatus of claim 13, wherein the first cryptographic process uses Gallois Counter Mode (GCM) to provide the first block of conditioned entropy.